Comment by zhivota

Seems like it was fly.io, since they got the user IP from there and it would make sense they would have the session logs.